CVE-2026-46582

A flaw was found in Unbound, a Domain Name System (DNS) resolver. A remote attacker can exploit a vulnerability in how Unbound handles expired DNSSEC (DNS Security Extensions) records. By injecting a replayed wildcard record set, an attacker can cause Unbound to temporarily consider it secure, leading to the caching of a poisoned record. This can result in information disclosure, where a legitimate DNS record is incorrectly resolved as a wildcard record, potentially misdirecting network traffic.

This issue has a Low impact as it requires a sophisticated attacker to inject specific DNSSEC wildcard replay data. The vulnerability in Unbound's handling of expired DNSSEC records could lead to temporary information disclosure, where a legitimate DNS record is briefly misresolved as a wildcard. This limited impact and the high attack complexity contribute to its Low severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the serve-expired feature by setting serve-expired: no in the Unbound configuration if it is not strictly required. This entirely removes the vulnerable code path where the cache poisoning occurs.